MpRtp.dll

Description: AntiMalware Realtime Monitor

Version: 4.18.1909.6

Architecture: 64-bit

Operating System: Windows NT

SHA256: 4c9324e03fc5ce4bc363bdd331a0f294

File Size: 872.4 KB

Uploaded At: Dec. 1, 2025, 8:30 a.m.

Views: 44

Security Warning

This file has been flagged as potentially dangerous.

Reason: Detected potentially dangerous functions used for process injection: OpenProcess

Exported Functions

MpPluginCheckExclusion (Ordinal: 1, Address: 0x3960)
MpPluginConfigChange (Ordinal: 2, Address: 0x2cb0)
MpPluginConfigDirectoryMonitoring (Ordinal: 3, Address: 0x2d50)
MpPluginConfigSyncMonitoring (Ordinal: 4, Address: 0x2d30)
MpPluginFlushLogData (Ordinal: 5, Address: 0x2ad0)
MpPluginGetConfigOperations (Ordinal: 6, Address: 0x2df0)
MpPluginGetHeartBeatData (Ordinal: 7, Address: 0x2c80)
MpPluginGetState (Ordinal: 8, Address: 0x2810)
MpPluginInitialize (Ordinal: 9, Address: 0x2290)
MpPluginIsSuspended (Ordinal: 10, Address: 0x2b60)
MpPluginNotifySetupProgress (Ordinal: 11, Address: 0x2b00)
MpPluginRegisterFriendlyProcess (Ordinal: 12, Address: 0x2bc0)
MpPluginReportThreadStatus (Ordinal: 13, Address: 0x2920)
MpPluginSetDefaultConfigs (Ordinal: 14, Address: 0x34f0)
MpPluginSetEngine (Ordinal: 15, Address: 0x2550)
MpPluginSetLastAccessTimeSuppressionMode (Ordinal: 16, Address: 0x3990)
MpPluginSetState (Ordinal: 17, Address: 0x2640)
MpPluginSetUserInformation (Ordinal: 18, Address: 0x2a00)
MpPluginShutdown (Ordinal: 19, Address: 0x2470)
MpPluginSignatureChange (Ordinal: 20, Address: 0x2af0)
MpPluginStop (Ordinal: 21, Address: 0x2710)
MpPluginUpdateDlpData (Ordinal: 22, Address: 0x3970)
MpPluginUpdateFolderGuardData (Ordinal: 23, Address: 0x2d10)
MpPluginUpdateMonitoringInfo (Ordinal: 24, Address: 0x2b80)
MpPluginUpdateMonitoringInfoEx (Ordinal: 25, Address: 0x2ba0)
MpPluginUpdateTPState (Ordinal: 26, Address: 0x3880)

Imported DLLs & Functions

ADVAPI32.dll

ConvertSecurityDescriptorToStringSecurityDescriptorW (Address: 0x75e89ed78)
ConvertSidToStringSidW (Address: 0x75e89ed00)
CopySid (Address: 0x75e89ece0)
DuplicateToken (Address: 0x75e89ed08)
DuplicateTokenEx (Address: 0x75e89ed18)
GetLengthSid (Address: 0x75e89ecd0)
GetTokenInformation (Address: 0x75e89ecc8)
GetTraceEnableFlags (Address: 0x75e89ed60)
GetTraceEnableLevel (Address: 0x75e89ed68)
GetTraceLoggerHandle (Address: 0x75e89ed70)
IsValidSid (Address: 0x75e89ecd8)
OpenProcessToken (Address: 0x75e89ed20)
OpenThreadToken (Address: 0x75e89ed28)
RegCloseKey (Address: 0x75e89ecf8)
RegDeleteKeyValueW (Address: 0x75e89ed40)
RegisterTraceGuidsW (Address: 0x75e89ed58)
RegOpenKeyExW (Address: 0x75e89ece8)
RegQueryValueExW (Address: 0x75e89ecf0)
RevertToSelf (Address: 0x75e89ed30)
SetThreadToken (Address: 0x75e89ed10)
TraceEvent (Address: 0x75e89ed38)
TraceMessage (Address: 0x75e89ed48)
UnregisterTraceGuids (Address: 0x75e89ed50)

KERNEL32.dll

AcquireSRWLockExclusive (Address: 0x75e89eec8)
AcquireSRWLockShared (Address: 0x75e89eeb8)
CloseHandle (Address: 0x75e89ede8)
CreateEventW (Address: 0x75e89edc8)
CreateFileW (Address: 0x75e89ef30)
CreateIoCompletionPort (Address: 0x75e89ee88)
CreateSemaphoreW (Address: 0x75e89ef10)
CreateThread (Address: 0x75e89ef60)
DecodePointer (Address: 0x75e89ef48)
DeleteCriticalSection (Address: 0x75e89f090)
DeviceIoControl (Address: 0x75e89ee50)
EncodePointer (Address: 0x75e89edb0)
EnterCriticalSection (Address: 0x75e89f0a0)
EnumSystemLocalesW (Address: 0x75e89f018)
ExitProcess (Address: 0x75e89efd8)
ExitThread (Address: 0x75e89ef68)
ExpandEnvironmentStringsW (Address: 0x75e89eee8)
FindClose (Address: 0x75e89ee68)
FindFirstFileExW (Address: 0x75e89ef78)
FindFirstFileW (Address: 0x75e89eed8)
FindNextFileW (Address: 0x75e89eee0)
FlushFileBuffers (Address: 0x75e89ee20)
FreeEnvironmentStringsW (Address: 0x75e89ef98)
FreeLibrary (Address: 0x75e89f058)
FreeLibraryAndExitThread (Address: 0x75e89ef70)
GetACP (Address: 0x75e89f008)
GetCommandLineA (Address: 0x75e89ef80)
GetCommandLineW (Address: 0x75e89ef88)
GetConsoleCP (Address: 0x75e89efb8)
GetConsoleMode (Address: 0x75e89efc0)
GetCPInfo (Address: 0x75e89eff8)
GetCurrentProcess (Address: 0x75e89f0e8)
GetCurrentProcessId (Address: 0x75e89ed90)
GetCurrentThread (Address: 0x75e89f0c0)
GetCurrentThreadId (Address: 0x75e89f0b8)
GetDateFormatW (Address: 0x75e89f048)
GetEnvironmentStringsW (Address: 0x75e89ef90)
GetFileAttributesW (Address: 0x75e89ef00)
GetFileType (Address: 0x75e89efa8)
GetLastError (Address: 0x75e89f0d0)
GetLocaleInfoW (Address: 0x75e89f030)
GetLocalTime (Address: 0x75e89ee10)
GetLogicalDriveStringsW (Address: 0x75e89ee58)
GetModuleFileNameW (Address: 0x75e89eef0)
GetModuleHandleExW (Address: 0x75e89efd0)
GetModuleHandleW (Address: 0x75e89f128)
GetOEMCP (Address: 0x75e89f000)
GetProcAddress (Address: 0x75e89f120)
GetProcessHeap (Address: 0x75e89efe0)
GetProcessTimes (Address: 0x75e89f150)
GetQueuedCompletionStatus (Address: 0x75e89ee98)
GetStartupInfoW (Address: 0x75e89ee08)
GetStdHandle (Address: 0x75e89efa0)
GetStringTypeW (Address: 0x75e89eff0)
GetSystemDirectoryW (Address: 0x75e89ef08)
GetSystemInfo (Address: 0x75e89ee38)
GetSystemTimeAsFileTime (Address: 0x75e89f060)
GetThreadPriority (Address: 0x75e89eea8)
GetTickCount (Address: 0x75e89ee40)
GetTimeFormatW (Address: 0x75e89f040)
GetUserDefaultLCID (Address: 0x75e89f020)
GetVersionExW (Address: 0x75e89f130)
GlobalMemoryStatusEx (Address: 0x75e89ee78)
HeapAlloc (Address: 0x75e89f0a8)
HeapFree (Address: 0x75e89f0b0)
HeapReAlloc (Address: 0x75e89edf0)
HeapSize (Address: 0x75e89edf8)
InitializeCriticalSectionAndSpinCount (Address: 0x75e89f088)
InitializeCriticalSectionEx (Address: 0x75e89ef50)
InitializeSListHead (Address: 0x75e89ed98)
InitializeSRWLock (Address: 0x75e89eeb0)
InitOnceExecuteOnce (Address: 0x75e89ef40)
InterlockedFlushSList (Address: 0x75e89eda8)
IsDebuggerPresent (Address: 0x75e89f100)
IsProcessorFeaturePresent (Address: 0x75e89f0d8)
IsValidCodePage (Address: 0x75e89f010)
IsValidLocale (Address: 0x75e89f028)
K32GetModuleFileNameExW (Address: 0x75e89f158)
K32GetProcessImageFileNameW (Address: 0x75e89f160)
LCMapStringEx (Address: 0x75e89ef58)
LCMapStringW (Address: 0x75e89f038)
LeaveCriticalSection (Address: 0x75e89f098)
LoadLibraryExA (Address: 0x75e89f140)
LoadLibraryExW (Address: 0x75e89f050)
LocalFree (Address: 0x75e89ee80)
MultiByteToWideChar (Address: 0x75e89efe8)
OpenProcess (Address: 0x75e89ee30)
OpenThread (Address: 0x75e89ee28)
PostQueuedCompletionStatus (Address: 0x75e89ee90)
ProcessIdToSessionId (Address: 0x75e89ee70)
QueryDosDeviceW (Address: 0x75e89ee48)
QueryPerformanceCounter (Address: 0x75e89ed88)
RaiseException (Address: 0x75e89edb8)
ReleaseSemaphore (Address: 0x75e89f138)
ReleaseSRWLockExclusive (Address: 0x75e89eed0)
ReleaseSRWLockShared (Address: 0x75e89eec0)
ResetEvent (Address: 0x75e89edd8)
RtlCaptureContext (Address: 0x75e89f118)
RtlLookupFunctionEntry (Address: 0x75e89f110)
RtlPcToFileHeader (Address: 0x75e89edc0)
RtlUnwindEx (Address: 0x75e89eda0)
RtlVirtualUnwind (Address: 0x75e89f108)
SetEvent (Address: 0x75e89ede0)
SetFilePointerEx (Address: 0x75e89ef38)
SetLastError (Address: 0x75e89f0c8)
SetStdHandle (Address: 0x75e89efb0)
SetThreadPriority (Address: 0x75e89eea0)
SetUnhandledExceptionFilter (Address: 0x75e89f0f0)
Sleep (Address: 0x75e89ee18)
SwitchToThread (Address: 0x75e89ef20)
TerminateProcess (Address: 0x75e89f0e0)
TlsAlloc (Address: 0x75e89f080)
TlsFree (Address: 0x75e89f068)
TlsGetValue (Address: 0x75e89f078)
TlsSetValue (Address: 0x75e89f070)
UnhandledExceptionFilter (Address: 0x75e89f0f8)
UnmapViewOfFile (Address: 0x75e89ee60)
VirtualProtect (Address: 0x75e89f148)
VirtualQuery (Address: 0x75e89ef18)
WaitForSingleObject (Address: 0x75e89eef8)
WaitForSingleObjectEx (Address: 0x75e89edd0)
WideCharToMultiByte (Address: 0x75e89ee00)
WriteConsoleW (Address: 0x75e89efc8)
WriteFile (Address: 0x75e89ef28)

mpclient.dll

MpAllocMemory (Address: 0x75e89f1d0)
MpClientUtilExportFunctions (Address: 0x75e89f1c8)
MpConfigClose (Address: 0x75e89f1f8)
MpConfigGetValue (Address: 0x75e89f1f0)
MpConfigGetValueAlloc (Address: 0x75e89f200)
MpConfigOpen (Address: 0x75e89f1e8)
MpConfigRegisterForNotifications (Address: 0x75e89f208)
MpConfigSetValue (Address: 0x75e89f1b8)
MpConfigUnregisterNotifications (Address: 0x75e89f210)
MpFreeMemory (Address: 0x75e89f1d8)
MpHandleClose (Address: 0x75e89f218)
MpManagerOpen (Address: 0x75e89f1c0)
MpManagerVersionQuery (Address: 0x75e89f1e0)
MpUtilsExportFunctions (Address: 0x75e89f220)

ntdll.dll

NtClose (Address: 0x75e89f248)
NtCreateFile (Address: 0x75e89f260)
NtDeviceIoControlFile (Address: 0x75e89f268)
NtMapViewOfSection (Address: 0x75e89f238)
NtWaitForSingleObject (Address: 0x75e89f250)
RtlCompareUnicodeString (Address: 0x75e89f240)
RtlInitUnicodeString (Address: 0x75e89f258)
RtlNtStatusToDosError (Address: 0x75e89f270)
RtlPrefixUnicodeString (Address: 0x75e89f230)

ole32.dll

CoCreateGuid (Address: 0x75e89f298)
CoCreateInstance (Address: 0x75e89f290)
CoInitializeEx (Address: 0x75e89f280)
CoSetProxyBlanket (Address: 0x75e89f288)
CoUninitialize (Address: 0x75e89f2a8)
IIDFromString (Address: 0x75e89f2a0)
StringFromGUID2 (Address: 0x75e89f2b0)

OLEAUT32.dll

SysAllocString (Address: 0x75e89f190)
SysFreeString (Address: 0x75e89f198)
SysStringLen (Address: 0x75e89f188)
VariantChangeType (Address: 0x75e89f180)
VariantClear (Address: 0x75e89f178)
VariantInit (Address: 0x75e89f170)

USER32.dll

GetSystemMetrics (Address: 0x75e89f1a8)